Computing devices are being used to store and transmit vast amounts of sensitive data. Computing devices that are connected to the Internet or other networks (e.g., cellular phone networks) are under constant attack by hackers seeking to obtain or destroy such sensitive data. To ensure the privacy of the sensitive data during both storage and transmission, many different security tools have been implemented to secure such sensitive data. The security tools include application level firewall tools and Internet Protocol (“IP”) security tools. An application level firewall allows restrictions to be placed on the source and destination of data that is transmitted between applications executing on different computing devices. For example, an application level firewall may prevent a computing device that is not authorized to send data to a protected computing device from doing so. The firewall may intercept all data that is sent to the protected computing device and discard the data when it is not from a computing device with an authorized IP address. An application level firewall may also restrict access based on port number associated with an application. The restricting of the users and the computing devices from which a protected computing device can receive data can help prevent malicious attacks by malware that seeks to exploit a vulnerability of a computing device. Such malware may include rootkits, Trojan horses, keystroke loggers, and so on.
IP security tools seek to ensure the identity of computing devices receiving or transmitting data and the privacy of the data while in transit. Authentication is a process to help ensure the identity of a computing device, and encryption and integrity protection are processes to help ensure the privacy and integrity of data. IP security tools typically implement the IPsec protocols as defined by RFC 1826 of the Internet Engineering Task Force (“IETF”) entitled “IP Authentication Header (AH)” and by RFC 1827 of the IETF entitled “IP Encapsulating Security Payload (ESP).” The AH protocol is used to provide security services such as connectionless integrity and data origin authentication of IP data. The security services can be provided between a pair of communicating hosts, between a pair of communicating security gateways, or between a security gateway and a host. The ESP protocol is designed to provide a mix of security services alone or in combination with the AH protocol. The ESP protocol can be used to provide confidentiality, data origin authentication, and connectionless integrity. The AH and ESP protocols allow data to be transmitted securely between computing devices. The IPsec protocols may use RFC 2409 of the IETF entitled “Internet Key Exchange Protocol” to exchange keys between a pair of communicating devices.
Although tools that implement firewalls and IPsec can help ensure data security of the sensitive data, the configuring of firewalls and IPsec tools can be both difficult and tedious. Typically, such configuration is performed by security personnel of the enterprise who seek to establish a security policy for the enterprise. Security policy may use firewall rules and IPsec or connection rules to define how computing devices of the enterprise communicate with other computing devices both internal and external to the enterprise. Security personnel typically use a firewall tool to define the firewall rules and use an IPsec tool to define the IPsec rules. Security personnel need to coordinate the firewall rules and the IPsec rules to ensure that they are consistent and correctly implement the desired security policy of the enterprise. It can be particularly difficult for security personnel to configure an IPsec tool to implement a security policy because of the complexity of IPsec, because IPsec terminology can be confusing and inconsistent, and because many decisions need to be made by security personnel. Moreover, because firewall and IPsec are overlapping technologies, it is easy for security personnel to be confused over how to implement an enterprise security policy. As a result, the implementations of security policies of many enterprises may not provide the desired level of security, which leaves the computing devices of the enterprise vulnerable to attack.
IPsec security policies are further difficult to implement because they require that the outbound security policy of an outbound device be symmetric with the inbound security policy of an inbound device. In particular, a crypto suite of security algorithms of an outbound security policy needs to match a crypto suite of security algorithms of an inbound security policy. Since selecting of security algorithms for security policies can be both tedious and complex, it can be difficult for administrators to establish matching inbound and outbound security policies.